# Engineering Manager, Security (Cloud, Infrastructure & Application Security) **Company**: Replit **Location**: Foster City, California **Work arrangement**: hybrid **Experience**: senior **Job type**: full-time **Salary**: $250K - $387K **Category**: Security **Industry**: Technology **Wikidata**: https://www.wikidata.org/wiki/Q60768699 **Apply**: https://jobs.ashbyhq.com/replit/2b296184-4ef9-4587-98ec-cd20f39e003e?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/job/engineering-manager-security-cloud-infrastructure-0e2ea6be-d0f/ ## Description Replit is looking for an Engineering Manager, Security to lead the teams that secure our cloud, infrastructure, and code. You will manage two closely linked groups: Cloud & Infrastructure Security and Application Security & Secure SDLC. The core responsibility of this role is getting vulnerabilities fixed on time. You will partner with engineering teams across the company to drive remediation of cloud, infrastructure, and code findings within SLA, so that we consistently meet our compliance commitments (SOC 2, ISO 27001, PCI DSS, FedRAMP, and customer contracts). **Team Leadership & Strategy** - Build, lead, and mentor a team of cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management. - Define the multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC, balancing risk reduction against developer velocity. - Set clear ownership, operating rhythms, and on-call/escalation processes across the team. - Report on security posture, risk trends, and program metrics to engineering and executive leadership. **Remediation & Compliance Delivery** - Own remediation SLAs by severity across cloud, infrastructure, container, and code findings, and make sure they map to our compliance obligations (SOC 2, ISO 27001, PCI DSS, FedRAMP, customer contracts). - Partner with engineering managers and tech leads to plan, prioritize, and land fixes within SLA without stalling roadmaps. - Run a regular remediation review with engineering leadership: open findings, SLA burn-down, upcoming SLA breaches, and owners. - Manage the exception and risk-acceptance process: documented justification, compensating controls, expiry dates, and approvals. - Build automated workflows that route findings to the right owning team, track them to closure, and escalate before SLAs are breached. - Work with Compliance/GRC to produce audit-ready evidence of remediation timeliness, and lead the security side of external audits for vulnerability management controls. - Track and report metrics such as SLA attainment, mean time to remediate, backlog age, and exceptions, by team and severity. **Cloud & Infrastructure Security** - Lead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services, from scanning and contextual risk triage to remediation workflows. - Oversee configuration hardening and secure baselines across GCP (primary) and supporting AWS and Azure environments. - Own the strategy for Cloud, Kubernetes, and Data Security Posture Management (CSPM, KSPM, DSPM) tooling; make sure findings are accurate, prioritized, and actionable. - Secure critical SaaS platforms with sound configurations, access controls, and integrations. - Partner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure. **Application Security & Code Scanning** - Own the SCA, SAST, and IaC scanning programs end to end: tool selection, CI/CD integration, rule tuning, noise reduction, and developer experience. - Drive software supply chain security, including dependency management, SBOMs, artifact signing, and progress through SLSA levels. - Feed code-scanning findings into the central remediation workflow so they reach the owning team automatically and are tracked against SLA. - Shift IaC security left so misconfigurations are caught in pull requests, before they reach production. **Secure SDLC & Developer Enablement** - Define and run the Secure SDLC program: security requirements, threat modeling, secure design reviews, and release gates proportionate to risk. - Build and deliver security training, including onboarding, role-based secure coding training, and targeted sessions driven by real vulnerability trends. - Develop paved roads, secure defaults, and guardrails that make the secure path the easiest path for engineers. - Grow a Security Champions network across engineering teams. **Incident Response Partnership & Collaboration** - Understand the incident response lifecycle well enough to support the IR team: supply asset, exposure, and vulnerability context, and help assess blast radius. - Own follow-up remediation from incidents and postmortems that touch cloud, infrastructure, or code, and track it to closure. - Feed incident learnings back into scanning rules, secure baselines, and developer training. - Collaborate with Security Monitoring/Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering. - Help communicate security advisories, best practices, and updates to customers. - Tune into threat intelligence alerts to promptly manage patching of critical, exploitable vulnerabilities. For more fresh new jobs, check out [yubhub.co](https://yubhub.co/). ## Skills ### Required - cloud security - DevSecOps - GCP - AWS - Azure - Kubernetes - container security - Infrastructure-as-Code - Python - Go - TypeScript - SCA - SAST - IaC scanning - CSPM/CNAPP platforms - Wiz - Orca - Prisma Cloud - Lacework - GCP Security Command Center - Snyk - Semgrep - CodeQL - Checkmarx - Socket - Dependabot - Checkov - tfsec ### Nice to have - Experience securing developer platforms - multi-tenant SaaS - AI/ML infrastructure - software supply chain frameworks (SLSA, Sigstore, SBOM standards) - Security Champions program - developer-facing security tooling - leading the security side of external audits (SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP) - relevant certifications (e.g., CCSP, GCP Professional Cloud Security Engineer, OSCP, CSSLP) --- Source: [Apply at jobs.ashbyhq.com](https://jobs.ashbyhq.com/replit/2b296184-4ef9-4587-98ec-cd20f39e003e?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)